StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
Tag
#Malware
24 results in the archive.
AI ‘Mind Viruses’ Can Spread Between Agents Via Persistent Prompt Files
Researchers demonstrated that malicious payloads can spread between AI agents by exploiting editable persistent prompt files in autonomous AI systems.
Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
Over 737 fake VPN and proxy extensions on the Chrome Web Store routed user traffic through SOCKS5 proxies controlled by a single entity, posing serious privacy and security risks.
Sandworm-Linked Group Uses Fake Job Interviews to Deploy Malware
CERT-UA reports Sandworm subgroup UAC-0145 targets Ukrainian IT workers with fake job interviews to deploy malware via a malicious VPN tool.
Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
North Korea’s APT group Kimsuky has implemented an offline AI infrastructure that advances their phishing tactics and automates malware development by integrating AI with internal document search and malware creation tools.
Nearly 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
A campaign distributing nearly 800 malicious npm packages with typo-squatted AI-generated names delivers a powerful RAT and infostealer targeting Windows, Mac, and Linux environments, posing a significant threat to developers and enterprises using npm packages.
ChainDrop Malware Infects 1,300+ npm Packages in Supply-Chain Attack
The ChainDrop malware has compromised over 1,300 npm packages, impacting software supply chain security with billions of downloads monthly.
How Threat Actors Are Weaponizing Cloud-Based AI: A Data-Driven Review
Talos analyzed prompt logs from various AI applications used by threat actors to understand their evolving tactics, revealing increased sophistication in leveraging cloud-based AI for malicious activities.
DOUBLECUP ClickFix Service Hides Malware in Browser Cache Images
The DOUBLECUP loader uses ClickFix attacks to embed malware within PNG images cached by browsers on Windows and macOS, complicating detection.
Chinese-Speaking Hackers Target Central Asian Governments Using OctLurk, SilkLurk
A suspected Chinese-speaking threat actor has targeted Central Asian government organizations with OctLurk and SilkLurk malware since January 2025, impacting healthcare, research, and government sectors.
Midnight Blizzard's CaptiveCrunch targets travelers with malware and credential theft
The Russian threat group Midnight Blizzard's Storm-2945 sub-cluster has compromised hospitality sign-in portals worldwide since May 2026, delivering malware and stealing traveler credentials.
DPRK-Linked macOS Malvertising Uses Fake Updates to Steal Crypto
North Korean threat actors have launched a sophisticated macOS malvertising campaign using fake update prompts to deliver crypto-stealing malware as part of the ongoing Contagious Interview operation.
Nimbus Manticore Uses NightLedger Backdoor to Target Middle East, Africa, Asia
Iranian state-backed group Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers in attacks across the Middle East, Africa, and South Asia, enhancing stealth and covert activity.
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA has identified a campaign where a fake Notepad++ plugin delivers MATCHBOIL.V2 malware, linked to the Russia-aligned UAC-0099 threat group targeting Windows systems.
FakeGit Campaign Uses 7,600 GitHub Repos to Spread SmartLoader Malware
Nearly 7,600 malicious GitHub repositories were discovered distributing the SmartLoader malware, leveraging cloned projects and fake profiles to deceive users.
North Korean Hackers Use Steganography in Fake Coding Tests to Deliver Malware
North Korean threat actors linked to the Contagious Interview campaign employ steganography within SVG flag images in fake coding challenges to deliver multi-stage OTTERCOOKIE-aligned malware.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Seven malicious npm packages in the Vite ecosystem use a four-tier blockchain-based command-and-control infrastructure to deploy RAT malware, expanding the ChainVeil supply chain threat.
New OkoBot framework deploys 20 payloads targeting crypto and data theft
The OkoBot malware framework deploys more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and sensitive data, posing a notable threat to individuals and enterprises.
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Researchers revealed TuxBot v3 Evolution, an IoT botnet framework apparently developed with help from a large language model, highlighting emerging AI-assisted malware creation risks.
Hackers Backdoor Jscrambler npm Package with Infostealer Malware
A malicious version of the Jscrambler npm package containing infostealer malware was published and downloaded nearly 1,500 times, posing risks to developers and users of this client-side security tool.
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK GitHub repository to publish a malicious npm package that steals cryptocurrency wallet private keys and seed phrases. This malware poses a direct threat to developers and users managing crypto assets.
Microsoft Uncovers GigaWiper Backdoor Combining Disk Wiping and Spyware
Microsoft has analyzed a new Windows backdoor called GigaWiper that merges three destructive tools: full disk wiping, Windows drive overwriting, and fake ransomware that scrambles files without saving keys. This modular malware gives operators multiple ways to disrupt or destroy infected machines.
New Ghost Phishing Wave Evades Traditional Email Security
A new EvilTokens campaign uses ghost phishing to bypass traditional email security by hiding malicious pages until decrypted inside a victim’s browser. This poses high risk to businesses using Microsoft 365 and handling sensitive data.
Fake IT Support Calls on Microsoft Teams Spread EtherRAT Malware
Threat actors are impersonating IT support via Microsoft Teams voice calls to trick employees into installing EtherRAT malware, compromising corporate networks. This tactic enables attackers to gain initial access and conduct further intrusion.